1. Field of the Invention
This invention relates generally to malware detection, and more particularly to systems and methods for providing a hardware-based program flow monitor for embedded software that employs a static analysis of the program code, marries the binary code to addresses while considering which processor will be executing the code, captures the expected control flow of the program and stores them as physical address pairs. Thereafter, a hardware component monitors the control flow at runtime and compares the runtime control flow to the expected control flow to detect malicious code.
2. Description of the Related Art
Current software systems are vulnerable to attack from people and systems known as “hackers” who seek to compromise a system by introducing carefully crafted instructions into an otherwise healthy software system. These instructions, referred to as ‘malware’, are often introduced as ‘patches’ that overlay a block of instructions belonging to the healthy program. Alternately, the malware can be placed in an unused area of memory. To execute malware, the hacker often redirects the target of a branch or jump instruction to the memory address where the malware resides.
Presently available malware detection solutions are software-based and often run only at system startup (and never again until the next power cycle). Other similar solutions run in very limited instances during system operation—such as when specific system calls are invoked. The sparse monitoring just described leaves the system vulnerable whenever there is a gap in the monitoring. In both cases, this leaves the door wide open for malware to be inserted, executed, and even removed before detection. In addition, a software based solution is vulnerable because a hacker can:    1. Disable the malware detector from running at all.    2. Modify the malware detector such that it either accomplishes nothing useful or is prevented from reporting the errors it found.
Software-based malware detection solutions search for known malware patterns. The set of known patterns grows with each new virus released and the software-based tools, therefore, must be kept up to date and their suite of known patterns kept current. Maintaining a database of known patterns is a labor-intensive, manual task. In addition, a software solution to malware detection relies heavily on the health of the host software environment—for example the operating system, utilities, library functions, etc. must be trustworthy and healthy. Unfortunately, the host software environment is itself vulnerable to attacks and the presence of malware in the supporting environment serves to undermine the efforts of the malware detection software. The health of the host environment is not easily proven, and yet the trustworthiness of the supporting environment is prerequisite if a software-based solution to malware detection is to be trusted. Moreover, the question remains—How can the user be certain that the malware detection software is not also infected?